subdomain-takeoverlisted

# SKILL: Subdomain Takeover — Detection & Exploitation Playbook > **AI LOAD INSTRUCTION**: Covers CNAME/NS/MX takeover, per-provider fingerprint matching, claim procedures, and defensive monitoring. Base models often confuse "CNAME exists" with "takeover possible" — the key is whether the *resource behind the CNAME is unclaimed and claimable*. ## 0. RELATED ROUTING - [ssrf-server-side-request-forgery](../ssrf-server-side-request-forgery/SKILL.md) when a subdomain takeover is used to bypass SSRF allowlists trusting `*.target.com` - [cors-cross-origin-misconfiguration](../cors-cross-origin-misconfiguration/SKILL.md) when CORS trusts `*.target.com` — takeover → full cross-origin read - [xss-cross-site-scripting](../xss-cross-site-scripting/SKILL.md) takeover gives you script execution under target origin (cookie theft, OAuth redirect abuse) - [http-host-header-attacks](../http-host-header-attacks/SKILL.md) when Host routing leads to subdomain-scoped cache or auth issues - [web-cache-deception](../web-cache-deception/SKILL.md) when a taken-over subdomain shares cache with the main domain --- ## 1. CORE CONCEPT Subdomain takeover occurs when: 1. `sub.target.com` has a DNS record (CNAME, NS, A) pointing to an external service 2. The external resource is **no longer provisioned** (deleted S3 bucket, removed Heroku app, etc.) 3. The attacker can **register/claim** that exact resource name on the provider 4. The attacker now controls content served under `sub.target.com` **Imp